- Add .github/scripts/ci-validate-upgrade.sh (single source for Docker validation)
- validate-on-os: run script inside container instead of inline bash -c
- Avoids nested quoting and glob/exit behavior differences across shells
- Same script can be run locally: bash .github/scripts/ci-validate-upgrade.sh